Cisco SCOR / CCNP Security Core 350-701 (350-701) — Questions 76–150

Geolocation filtering is applied in access control rules. The block rule must be placed before any allow rules to ensure traffic from North Korea is blocked. Rule order is top-down.

The 'authentication order mab dot1x' command configures the switch to attempt MAB first and then fall back to 802.1X if MAB fails. This is the exact requirement for devices that do not support 802.1X, ensuring they are authenticated via MAC address while still allowing 802.1X for capable devices.

URL filtering allows blocking or allowing access based on URL categories (e.g., Social Networking). Application visibility and control (AVC) can block specific applications, but URL filtering is more appropriate for web browsing categories.

Cisco WSA URL filtering categories allow administrators to block entire groups of known malicious sites, such as malware, phishing, or spyware categories, which are pre-classified by Cisco Talos. This provides a broad, proactive defense against threats without needing to maintain individual URL block lists. Option E is correct because Web Reputation filtering uses a scoring system (1–10, with lower scores being more malicious) to dynamically block or warn users about websites with poor reputation, even if they are not in a specific malicious category, adding a layer of behavioral analysis.

The AMP for Endpoints connector sends a SHA-256 hash of the file to the AMP cloud for analysis. If the cloud determines the file is malicious but the endpoint still allows execution, the most likely reason is that the AMP policy has been configured with a custom rule or a confidence threshold that permits files at that specific malicious confidence level. This overrides the default block action for known malware.

The action is the first field in a Snort rule (e.g., alert, drop, reject).

CSPM is designed to detect and remediate cloud resource misconfigurations, such as publicly accessible S3 buckets, which are a leading cause of data breaches. It continuously assesses cloud infrastructure against security best practices and compliance frameworks like CIS and PCI DSS. Unlike network-based tools, CSPM focuses on the configuration state of cloud resources rather than inspecting traffic or managing identities.

Exploit Prevention in Cisco AMP protects against memory injection and other exploit techniques by monitoring process behavior.

Encryption for data in transit is a core component of Cisco's SAFE model because it ensures confidentiality and integrity of traffic traversing the network. SAFE mandates encryption protocols such as IPsec, TLS, or MACsec to protect against eavesdropping and man-in-the-middle attacks. This aligns with the model's principle of maintaining trustworthiness across all communication paths.

In PaaS, the provider manages the runtime, middleware, OS, and infrastructure. The customer is responsible for the application code and data. Network controls and hypervisor are provider responsibilities.

Process isolation is not a standard AMP action; however, AMP allows endpoint isolation (network containment) and remote shell for investigation. The best option is to isolate the endpoint and use remote shell. But since only one action is allowed, 'Isolate' is the correct answer as it blocks network traffic while allowing AMP management.

Signature-based detection uses predefined patterns (signatures) to identify known attacks. Anomaly-based detection looks for deviations from normal behavior.

Cisco Umbrella SIG includes a cloud-delivered firewall and a web proxy for URL filtering. DNS-layer security is a separate feature, and VPN is not part of SIG. DLP is typically a CASB function.

The most likely cause is that the banking website uses HTTP Public Key Pinning (HPKP) or certificate pinning. When the WSA performs HTTPS decryption, it generates a new certificate for the site, which does not match the pinned public key or certificate hash that the browser expects. This mismatch triggers a certificate error, even though the WSA's CA is trusted.

CASB provides visibility, DLP, and threat detection for sanctioned and unsanctioned cloud apps.

In active/standby failover, the active unit can be forced to become standby and the standby active. To make the recovered primary active, the command 'failover active' on the primary or 'failover reset' can be used. However, by default, the primary will not automatically become active unless configured with preempt.

MAB allows non-supplicant devices to be authenticated based on their MAC address. Profiling can identify the device type and apply appropriate policies. 802.1X requires a supplicant, and PEAP-MSCHAPv2 is a credential-based EAP method that also requires a supplicant.

The file policy can use dispositions from AMP: clean (allow), malicious (block), and unknown (allow but capture for further analysis).

The Umbrella roaming client's DNS Policy feature forces all DNS traffic from the endpoint to use Umbrella's DNS resolvers, even if the user manually configures a third-party DNS server like Google (8.8.8.8). This is achieved by intercepting DNS requests at the OS level and redirecting them to the Umbrella resolvers, effectively preventing bypass attempts without relying on network-level blocks.

Cisco Umbrella provides DNS-layer security as a core feature, which blocks requests to malicious domains before a connection is established, effectively preventing malware, phishing, and command-and-control callbacks. It also includes a Secure Web Gateway (SWG) that enforces URL filtering, application controls, and HTTPS inspection to protect users from web-based threats. These two capabilities are fundamental to Umbrella's cloud-delivered security architecture.

IaC scanning can use Checkov or similar, and container scanning tools like Trivy or Clair are common.

Change of Authorization (CoA) is the correct answer because it is the ISE feature that allows dynamic, real-time changes to an authenticated session, such as reassigning a VLAN, after a posture assessment. When a posture assessment determines an endpoint is non-compliant (e.g., missing a critical patch), ISE can send a CoA request (RFC 5176) to the network access device (NAD) to modify the session attributes, including VLAN assignment, without requiring the user to reauthenticate.

Checkov is an open-source static analysis tool for IaC (Terraform, CloudFormation) to detect security misconfigurations.

URL reputation filtering is correct because it uses the Cisco Talos threat intelligence to analyze and block emails containing malicious URLs based on real-time reputation scores. Cisco Advanced Phishing Protection is correct because it uses machine learning and behavioral analysis to detect and block sophisticated phishing URLs that may bypass traditional reputation checks.

EAP-TLS is the Extensible Authentication Protocol that uses certificates for mutual authentication.

The DHCP probe captures DHCP packets, including the vendor class identifier (option 60) which reveals the device type (e.g., 'MSFT 5.0' for Windows). The HTTP probe intercepts HTTP traffic and parses the User-Agent header (e.g., 'Mozilla/5.0 (Windows NT 10.0)') to identify the operating system and browser. Together, these two probes collect the exact information described in the question.

Network discovery requires enabling discovery in the FMC and configuring the FTD to perform discovery by applying an access control policy that allows discovery traffic or by configuring discovery settings. Also, the FTD must be in an appropriate mode (inline or passive) and have the necessary policies applied.

Mutual TLS (mTLS) provides both encryption and mutual authentication by requiring each workload to present a valid X.509 certificate during the TLS handshake. This ensures that only verified workloads can communicate, and all traffic is encrypted at the application layer, making it the ideal choice for a Zero Trust architecture where every connection is authenticated and authorized regardless of network location.

Transparent identification can use Active Directory or NTLM authentication without explicit proxy config.

DAP can use attributes from the AnyConnect client such as antivirus status, firewall status, and operating system. It can also use AAA attributes from RADIUS or LDAP. The Secure Endpoint (formerly AMP) connector provides device compliance data.

802.1X authentication is a valid NAC method because it enforces port-based access control by requiring end devices to authenticate via EAP (Extensible Authentication Protocol) before gaining network access. It integrates with a RADIUS server (e.g., Cisco ISE) to validate credentials and dynamically assign VLANs or ACLs based on policy, making it a core NAC technology.

AAA and RADIUS must be configured first, then the authentication list, global 802.1X enable, and finally interface-level enable.

Just-in-time (JIT) access provides time-limited elevated privileges that are automatically revoked after the task is completed, reducing the risk of standing privileges.

Exploit Prevention in Cisco AMP uses exploit mitigation techniques like memory protection and injection detection to block common exploit methods (e.g., buffer overflows, DLL injection) without needing signatures.

It specifies AES-256 encryption, which is the strongest symmetric cipher available in IPsec transform sets, combined with ESP-SHA256-HMAC for integrity and authentication. IKEv2 supports these modern algorithms, and this configuration meets the requirement for strong encryption and authentication.

Cisco Secure Workload (formerly Tetration) is the correct solution because it provides micro-segmentation for containers in Azure Kubernetes Service (AKS) by enforcing inter-container communication policies based on labels. It uses a Kubernetes-native approach, integrating with the Kubernetes API to discover pods and services, and applies label-based policies via eBPF or sidecar proxies to control traffic between containers without modifying the application.

Cisco WSA uses Cisco Talos web reputation scores to block access to malicious websites based on their reputation.

The ASA checks the connection table (conn table) first for stateful inspection. The xlate table is used for NAT translation, but connection table is checked for session state.

ACLs process traffic only on the interface and direction to which they are applied. If the ACL is applied inbound on GigabitEthernet0/0 but the traffic from host 10.1.1.100 to 192.168.1.1 enters through a different interface (e.g., GigabitEthernet0/1), the ACL will never evaluate that traffic, allowing it to pass. This is a fundamental behavior of interface-based ACL filtering in Cisco IOS.

EAP-TLS uses certificates for both client and server authentication, providing strong security.

Volumetric attacks aim to consume bandwidth. UDP floods, ICMP floods, and DNS amplification are common examples.

To reduce false positives, the rule can be disabled (noalert), thresholding can reduce alert frequency, or the rule can be modified to be more specific. Disabling is a common initial step if the rule is not needed.

First add the NAS, then define identity source, authentication policy, authorization policy, and finally test.

AWS Certificate Manager Private CA can integrate with a service mesh like Istio to automatically issue, distribute, and rotate mTLS certificates for each microservice. This eliminates the need for manual certificate management while ensuring encrypted and authenticated inter-service communication via mutual TLS.

The 'TCP state violation' drops during peak hours indicate that the FTD's stateful inspection engine is seeing TCP segments that do not match the expected state machine, likely due to asymmetric routing or session timeouts under load. Configuring TCP state bypass for the web server traffic disables stateful inspection for those flows, allowing the firewall to forward packets based on ACLs alone without tracking TCP states, which resolves the issue without compromising security for legitimate traffic.

The IKE phase 1 state is MM_NO_STATE, which indicates that the Internet Key Exchange (IKE) Main Mode negotiation has not completed. This typically occurs when the peers cannot agree on the IKE policy parameters (encryption, hash, Diffie-Hellman group, authentication method, or pre-shared key). Since phase 2 (IPsec SA) depends on a successful phase 1, the failure cascades, making an IKE policy mismatch the most likely root cause.

IronPort SenderBase uses a reputation score (SBRS) ranging from -10 to +10 to classify senders as trusted or spam sources.

Static NAT creates a one-to-one mapping between an internal private IP and an external public IP, translating both source and destination addresses symmetrically. It is commonly used to make internal servers accessible from the outside.

Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep connections open, exhausting server resources.

Cisco FTD supports high availability through Active/Standby failover (option D) and clustering (option B). Active/Standby failover provides stateful redundancy with one unit handling traffic while the other monitors and takes over upon failure. Clustering groups multiple FTD devices into a single logical unit for both high availability and scalability, distributing traffic across members.

FTD supports decrypting traffic using a known private key (e.g., from a web server) or by re-signing certificates using a CA certificate installed on the device. The other options are not valid SSL decryption methods.

Cisco WSA can be deployed as an explicit proxy (browsers configured to use it) or as a transparent proxy using WCCP or other redirection methods.

The log shows the file 'invoice.pdf.exe' was quarantined based on local analysis after the cloud reputation returned an unknown verdict. Cisco Secure Endpoint uses a multi-layered approach: if the cloud reputation is unknown, the connector performs local analysis (e.g., static analysis, behavioral monitoring) to detect malicious behavior. In this case, the local analysis flagged the file as malicious, triggering the quarantine action.

Google Cloud Dedicated Interconnect provides direct private physical connections between on-premises and GCP VPCs.

When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.

Firepower URL filtering allows blocking by category, including social media.

Cisco Umbrella SIG provides DNS security and a cloud-based proxy for web filtering.

The 'switchport port-security mac-address sticky' command dynamically learns the MAC address of the first connected device and saves it as a sticky secure MAC address in the running configuration. Option E is correct because setting the maximum number of secure MAC addresses to 1 ensures that only the first device's MAC address is allowed; any additional device will trigger a security violation. Together, these two features enforce that only the first device can connect, and subsequent devices cause the port to enter an error-disabled state when combined with the shutdown violation mode.

IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

A is correct because NGFWs can perform SSL/TLS decryption and inspection, allowing them to examine encrypted traffic for threats. Traditional stateful firewalls only inspect packet headers and state information, leaving encrypted payloads unexamined. This capability is critical for detecting malware or data exfiltration hidden in HTTPS sessions.

MPF consists of class-maps to classify traffic, policy-maps to define actions, and service-policy to apply the policy to interfaces or globally. These are the three core components.

C is correct because Cisco ISE Posture Assessment is the component specifically designed to check endpoints for compliance with security policies, such as having antivirus running and up-to-date patches. It evaluates the endpoint's state before granting full network access, and can enforce remediation or restrict access based on the results.